Question: Is aws-cloudfront-s3 added bucket policy repetitive?

[robertd]

Hello :)

I have a question regarding aws-cloudfront-s3 construct. I've been experimenting with it, and I noticed some overlap in attached bucket policies here.

Action s3:GetObject has already been added through aws-cloudfront module, so I'm not sure why it was added again here. Thanks!

Note: Current aws-cloudfront-s3 uses older L2 construct of aws-cloudfront module. See #39.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "HttpsOnly",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "*",
            "Resource": "arn:aws:s3:::static-content-1234567890/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1VKUUXTUNNAAA"
            },
            "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*"
            ],
            "Resource": [
                "arn:aws:s3:::static-content-1234567890",
                "arn:aws:s3:::static-content-1234567890/*"
            ]
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E1VKUUXTUNNAAA"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::static-content-1234567890/*"
        }
    ]
}

[hnishar]

robertd@, I noticed the same as well when migrating to the new cloudfront L2 construct. It will be fixed with the migration issue

[robertd]

@hnishar Thanks for confirming this.

[hnishar]

The fix has been pushed out in the latest release v1.68.0